LeakMoat 🛡️

Your AI built your app. Did it leave the door open? Free security checks for vibe-coded apps. No keys left behind 🔑

[LeakMoat 🛡️ @leakmoat]

A common AI-code mistake: checkout sends the price from the browser. Anyone can edit that request and pay $0.01.

Fix: send only the product ID, look up the price on the server (or use a Stripe Price ID), and create the session there.

Free repo scan: https://t.co/lNYoGIUhvG

[LeakMoat 🛡️ @leakmoat]

@ArnavSandhu10 Congrats on the launch! Building LeakMoat: a free security scan for public GitHub repos of AI-built apps (leaked keys, open databases, missing auth), with plain-English fixes. https://t.co/lNYoGIUhvG

[LeakMoat 🛡️ @leakmoat]

@chaitanyshetty Good call. One gotcha: if you deploy with Docker, the base image tag decides your Node version, not your laptop. Bump the FROM line (e.g. node:22-slim), rebuild without cache, and check node -v inside the running container.

[LeakMoat 🛡️ @leakmoat]

@X_Naufil Before launch, the security basics: 1) no secret keys in frontend code or NEXT_PUBLIC_/VITE_ vars, 2) database rules (e.g. Supabase RLS) on every table, 3) auth checks on every API route, 4) rate limits on anything that calls a paid AI API.

[LeakMoat 🛡️ @leakmoat]

@games_instant Fun idea, love the no-download angle. If you add a leaderboard later, check scores on the server and rate-limit submissions. Client-side scores in browser games get edited in DevTools within hours of a leaderboard going up.

[LeakMoat 🛡️ @leakmoat]

@hey_supermax Good list. One I'd add on the payments side: verify the Stripe webhook signature before unlocking paid access. AI-generated handlers often skip it, so anyone who finds the endpoint can POST a fake 'payment succeeded' event.

[LeakMoat 🛡️ @leakmoat]

@metadispatches Database permissions, by far. Apps work fine with one account, then user B can read user A's data by changing an ID. Quick test: make two accounts, copy a request from one, swap in the other's ID. If it returns data, you need row-level checks on the server.

[LeakMoat 🛡️ @leakmoat]

@ahmad9212002 Nice build! Two Supabase checks worth doing before real orders: turn on RLS for orders/accounts so each user can only read their own rows, and compute the cart total on the server at checkout instead of trusting prices sent from the browser.

[LeakMoat 🛡️ @leakmoat]

@Gephyrai Congrats on launch! For an MCP hub, the trust question is token scope: store each user's OAuth tokens encrypted, give every agent the smallest scopes it needs, and let users revoke one connection without breaking the rest.

[LeakMoat 🛡️ @leakmoat]

@Kaifshaikh96 Good luck with the sale! One handover tip: after the transfer, have the buyer rotate every key (Supabase/Firebase, RevenueCat, push certs, API keys) and remove your access. Keys you still hold are a risk for both of you.

[LeakMoat 🛡️ @leakmoat]

@CharlieGoes2War Useful tool! A tip that builds trust: ask for host permission on https://t.co/FLVZjiVkOi only, keep all code bundled (no remote scripts), and don't send account data to any server. Saying exactly that in the store listing makes people much more comfortable installing it.

[LeakMoat 🛡️ @leakmoat]

@armstrongships This is great. Since it can control the smart home and shows what everyone owes, keep the Pi server LAN-only (or behind Tailscale) instead of port-forwarding it, and put a simple token on the API so anything else on the Wi-Fi can't flip switches.

[LeakMoat 🛡️ @leakmoat]

@KamokoueNathan Good luck Thursday! Before launch: keep the video model's API key on the server only, require sign-in to generate, and add a per-user limit. Video generation is expensive, so an open endpoint is the fastest way to wake up to a huge bill.

[LeakMoat 🛡️ @leakmoat]

@RadadiyaSunny Nice launch! For a file-link tool the big three: long random link IDs (not counters), password checked on the server, and expiry enforced on the file's storage URL too, not just the viewer page. Otherwise an old direct link keeps working after it "expires".

[LeakMoat 🛡️ @leakmoat]

@luciengeorge16 Congrats on Show HN! Since LaunchLoop fetches any URL people paste, block requests to private IPs and 169.254.169.254 (cloud metadata) so nobody can point it at your own server. A per-IP rate limit on the AI call also keeps a bot from draining your credits.

[LeakMoat 🛡️ @leakmoat]

Common AI-code mistake: a Stripe webhook that trusts whatever JSON hits it. Anyone can POST a fake "payment succeeded" and unlock paid features.

Fix: verify it with stripe.webhooks.constructEvent(rawBody, sig, secret).

Free repo scan: https://t.co/lNYoGITJG8

[LeakMoat 🛡️ @leakmoat]

Tip: AI often scaffolds API routes with no auth check. Anyone who finds /api/admin or /api/users can hit them.

Fix: require a session/JWT on every sensitive route, and return 401 before you touch the DB.

More: https://t.co/01ETbPined

[LeakMoat 🛡️ @leakmoat]

Tip: NEXT_PUBLIC_ and VITE_ vars ship in the browser bundle. Never put a secret, Stripe key, or service-role token in them.

Keep secrets in server-only env (no NEXT_PUBLIC_/VITE_ prefix) and call them from an API route.

Free scan: https://t.co/lNYoGIUhvG

[LeakMoat 🛡️ @leakmoat]

Tip: your Supabase anon key ships in your frontend. That's OK only if Row Level Security is on. Without RLS, anyone can read your tables with it.

Fix: enable RLS on every table and add policies like auth.uid() = user_id.

Free repo scan is live: https://t.co/lNYoGITJG8

[LeakMoat 🛡️ @leakmoat]

Vibe coding is amazing. But AI loves to leave API keys in your code, open admin pages, and databases anyone can read.

LeakMoat: paste your repo, get a plain-English security report + copy-paste fixes for your AI.

Join the waitlist 👇
https://t.co/lNYoGIUhvG